Conventional risk-based authentication includes an evaluation of multiple authentication factors to determine whether a human using a computer is authentic, i.e., not an imposter. In particular, a risk engine takes, as inputs, authentication factors such as username and password, time of day, IP address, and geolocation and outputs a risk score, i.e., a numerical value or measure indicating a likelihood that the human is an imposter.
If the risk score is less than a predetermined risk score threshold, authentication is considered successful, i.e., the human using the computer is considered to be authentic. However, if the risk score exceeds the predetermined risk score threshold, authentication is considered unsuccessful.